Controlled Unclassified Information (CUI) Cybersecurity Compliance

The contract requires full implementation of NIST SP 800-171 security controls to protect Covered Defense Information handled by the subcontractor, ensuring compliance with DFARS 252.204-7012. This includes establishing and maintaining robust cybersecurity measures to safeguard sensitive unclassified information, conducting regular assessments of security posture, and promptly reporting any cyber incidents affecting the integrity, confidentiality, or availability of Covered Defense Information. The subcontractor must align its information systems and operational practices with the specified standards to meet federal defense requirements and support continued eligibility for Department of Defense work. The contract is issued under the Defense Logistics Agency as part of the Department of Defense’s broader initiative to enforce cybersecurity hygiene across its supply chain. It is classified as a subcontract governed by NAICS code 541512, indicating involvement in computer systems design and related services. The requirement applies regardless of the physical or virtual location of the subcontractor’s operations, and compliance is mandatory for contract fulfillment. The subcontractor is expected to document, maintain, and present evidence of control implementation and incident reporting procedures upon request, with non-compliance potentially resulting in termination or penalties.